6 ms·

Everything you need to know about cryptography in 1 hour, by Colin Percival

136 points by ibejoeb 16y ago

nc17 16y ago
Thanks for posting this. Here are the slides for those interested: http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf http://www.bsdcan.org/2010/schedule/attachments/135_crypto1h...
pollockmania 16y ago
Thanks for this, Colin. I've never heard him speak, and I respect the guy, but does anyone think comic book guy?
- dauphin 16y ago
  > comic book guy? Totally!
- rewind 16y ago
  You "respect the guy", then throw out "comic book guy"? You think you're being funny. I'm guessing you're in the minority.
- cperciva 16y ago
  does anyone think comic book guy? Hey, I know I could afford to lose a few pounds, but I'm not that overweight. ;-)
tptacek 16y ago
From very early on in the talk: "Reality: Most applications only need a small set of well-understood standard idioms which are easy to get right." Turns out that sentence was within a "n't" of being totally true! :)
- mayank 16y ago
  Just curious -- is there anything in particular that stood out? Other than the inherent troubles with implementing crypto, was there anything theoretically questionable with any of the talk's content?
  - tptacek 16y ago
    You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? I can find things to disagree with on many of these slides (avoiding NSA suite B crypto in favor of RSA-2048, using RSA-2048 directly, avoiding AE cipher modes in favor of hand-hacking your own encrypt-then-HMAC scheme). But Colin is the professional cryptographer here; all I have to go on is the crypto flaws we find in other people's real-world systems, and the simple steps I see people could have taken to avoid having them even without knowing about them.
    - mayank 16y ago
      > You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? Oooh low blow! Point taken, but I think he did a pretty good job for 55 minutes. If someone decides to hand-roll AES-CTR, I'd say it's their job to go through all the literature (academic and otherwise), implement their own version and look at least a few open source implementations for differences, reconcile those difference (academic literature helps here), and then put their code up for review or audit. Perhaps even run several implementations through the same inputs and keys and compare outputs. Whether this actually gets done is of course a different issue. So if I understand correctly, your objection to hand-rolling encrypt-then-HMAC is that it's rarely done correctly (not a theoretical objection)?
      - tptacek 16y ago
        You don't have to "hand-roll" CTR mode to get this part wrong; you have to choose the nonce yourself, as the API user. My objection to encrypt-then-HMAC is that it adds a moving part to your design that you have to get right. If your toolkit doesn't provide a well-implemented AE cipher mode, (a) you're doomed, but (b) yes, you should probably use HMAC rather than trying to hand-roll CBC-MAC for CCM mode.
    - cperciva 16y ago
      You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? Didn't I say "and make sure your nonces are unique"? I remember taking it out of a slide because it wouldn't fit but I was pretty sure that I still said it. As for counter wraps, that really is a non-issue. Nobody here is ever going to send over 2^68 bytes of data in a single session.
- dauphin 16y ago
  You're so right.
dauphin 16y ago
Please (also) see http://news.ycombinator.com/item?id=2117387 http://news.ycombinator.com/item?id=2117387 and tptacek comments.
samstokes 16y ago
I get that there's a point to be made here to other people considering implementing their own crypto. But how is posting this anything other than kicking a man when he's down?
- idlewords 16y ago
  What better time to kick him? The point is not to make the guy feel bad, it's to drive home the point that even people of inordinate intelligence can and will get this stuff wrong. Hand-rolled crypto is like catnip to a certain class of programmer, since we all like to think we're brilliant enough to do it right if we just apply enough brainpower. This is a good object lesson we all need to learn from.
- alnayyir 16y ago
  Hackerne.ws has a real panache for comedic timing.
  - whatusername 16y ago
    The canonical URL is actually news.ycombinator.com // Just thought you might like to know.
    - alnayyir 16y ago
      I know what the canonical name is, but that's not a name, it's a url. This community is a 'thing' in and of itself and merits a name independent of a rather sterile subdomain.
      - whatusername 16y ago
        Sure. But the canonical name is Hacker News, HN for short. (Or Innocuous News when PG is feeling cheeky). And the canonical URL is news.ycombinator.com I pointed it out because some people don't realise that is the URL. But you piqued my curiosity. - http://hackerne.ws http://hackerne.ws is regered to Yiannis Volos, (who seems to own about 100,000 domains --- http://whois.domaintools.com/hackerne.ws http://whois.domaintools.com/hackerne.ws ) http://ycombinator.com http://ycombinator.com is registered to Paul Graham (who seems to own about 46 domains http://whois.domaintools.com/ycombinator.com http://whois.domaintools.com/ycombinator.com )
cpach 16y ago
Here's the original video page at blip.tv, with download link available: http://blip.tv/file/3627639 http://blip.tv/file/3627639
16s 16y ago
I think I saw the slides to this once. I don't have time to watch the video right now, but if it's the same presentation, he had a point about hashing a file and then uploading the file and the hash to the same web server for download. I forget the exact words, but the point read something like, "Don't think you've accomplished anything worthwhile if you place the hash and the file on the same web server." I agree with that, but am guilty of doing it all the time (as are others). Does anyone have a link to the raw slides (PDF)? I downloaded them once, but lost them.
drblast 16y ago
This is a good presentation. Unfortunately I'm not able to listen to it but the slides are informative. Colin, at about 26 minutes in your "DO" code is comparing the computed MAC with itself. I don't think that's what you want.
vibragiel 16y ago
This quote is my favourite part of the conference: "The purpose of cryptography is to force the US government to torture you."
- cperciva 16y ago
  That's my favourite line too -- I'm glad I'm not the only person who liked it. :-)
calloc 16y ago
The video is not playing here. Was it removed? Nevermind, noticed that it is going to Blip.tv, here it is on Blip.tv if the linked site doesn't work: http://blip.tv/file/3627639/ http://blip.tv/file/3627639/

136 points by ibejoeb 16y ago

nc17 16y ago

Thanks for posting this. Here are the slides for those interested: http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf http://www.bsdcan.org/2010/schedule/attachments/135_crypto1h...

pollockmania 16y ago

Thanks for this, Colin. I've never heard him speak, and I respect the guy, but does anyone think comic book guy?

dauphin 16y ago
> comic book guy? Totally!
rewind 16y ago
You "respect the guy", then throw out "comic book guy"? You think you're being funny. I'm guessing you're in the minority.
cperciva 16y ago
does anyone think comic book guy? Hey, I know I could afford to lose a few pounds, but I'm not that overweight. ;-)

tptacek 16y ago

From very early on in the talk: "Reality: Most applications only need a small set of well-understood standard idioms which are easy to get right." Turns out that sentence was within a "n't" of being totally true! :)

mayank 16y ago
Just curious -- is there anything in particular that stood out? Other than the inherent troubles with implementing crypto, was there anything theoretically questionable with any of the talk's content?
- tptacek 16y ago
  You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? I can find things to disagree with on many of these slides (avoiding NSA suite B crypto in favor of RSA-2048, using RSA-2048 directly, avoiding AE cipher modes in favor of hand-hacking your own encrypt-then-HMAC scheme). But Colin is the professional cryptographer here; all I have to go on is the crypto flaws we find in other people's real-world systems, and the simple steps I see people could have taken to avoid having them even without knowing about them.
  - mayank 16y ago
    > You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? Oooh low blow! Point taken, but I think he did a pretty good job for 55 minutes. If someone decides to hand-roll AES-CTR, I'd say it's their job to go through all the literature (academic and otherwise), implement their own version and look at least a few open source implementations for differences, reconcile those difference (academic literature helps here), and then put their code up for review or audit. Perhaps even run several implementations through the same inputs and keys and compare outputs. Whether this actually gets done is of course a different issue. So if I understand correctly, your objection to hand-rolling encrypt-then-HMAC is that it's rarely done correctly (not a theoretical objection)?
    - tptacek 16y ago
      You don't have to "hand-roll" CTR mode to get this part wrong; you have to choose the nonce yourself, as the API user. My objection to encrypt-then-HMAC is that it adds a moving part to your design that you have to get right. If your toolkit doesn't provide a well-implemented AE cipher mode, (a) you're doomed, but (b) yes, you should probably use HMAC rather than trying to hand-roll CBC-MAC for CCM mode.
  - cperciva 16y ago
    You mean, besides recommending CTR but not telling his audience about nonce collisions and counter wraps? Didn't I say "and make sure your nonces are unique"? I remember taking it out of a slide because it wouldn't fit but I was pretty sure that I still said it. As for counter wraps, that really is a non-issue. Nobody here is ever going to send over 2^68 bytes of data in a single session.
dauphin 16y ago
You're so right.

dauphin 16y ago

Please (also) see http://news.ycombinator.com/item?id=2117387 http://news.ycombinator.com/item?id=2117387 and tptacek comments.

samstokes 16y ago

I get that there's a point to be made here to other people considering implementing their own crypto. But how is posting this anything other than kicking a man when he's down?

idlewords 16y ago
What better time to kick him? The point is not to make the guy feel bad, it's to drive home the point that even people of inordinate intelligence can and will get this stuff wrong. Hand-rolled crypto is like catnip to a certain class of programmer, since we all like to think we're brilliant enough to do it right if we just apply enough brainpower. This is a good object lesson we all need to learn from.
alnayyir 16y ago
Hackerne.ws has a real panache for comedic timing.
- whatusername 16y ago
  The canonical URL is actually news.ycombinator.com // Just thought you might like to know.
  - alnayyir 16y ago
    I know what the canonical name is, but that's not a name, it's a url. This community is a 'thing' in and of itself and merits a name independent of a rather sterile subdomain.
    - whatusername 16y ago
      Sure. But the canonical name is Hacker News, HN for short. (Or Innocuous News when PG is feeling cheeky). And the canonical URL is news.ycombinator.com I pointed it out because some people don't realise that is the URL. But you piqued my curiosity. - http://hackerne.ws http://hackerne.ws is regered to Yiannis Volos, (who seems to own about 100,000 domains --- http://whois.domaintools.com/hackerne.ws http://whois.domaintools.com/hackerne.ws ) http://ycombinator.com http://ycombinator.com is registered to Paul Graham (who seems to own about 46 domains http://whois.domaintools.com/ycombinator.com http://whois.domaintools.com/ycombinator.com )

cpach 16y ago

Here's the original video page at blip.tv, with download link available: http://blip.tv/file/3627639 http://blip.tv/file/3627639

16s 16y ago

I think I saw the slides to this once. I don't have time to watch the video right now, but if it's the same presentation, he had a point about hashing a file and then uploading the file and the hash to the same web server for download. I forget the exact words, but the point read something like, "Don't think you've accomplished anything worthwhile if you place the hash and the file on the same web server." I agree with that, but am guilty of doing it all the time (as are others). Does anyone have a link to the raw slides (PDF)? I downloaded them once, but lost them.

drblast 16y ago

This is a good presentation. Unfortunately I'm not able to listen to it but the slides are informative. Colin, at about 26 minutes in your "DO" code is comparing the computed MAC with itself. I don't think that's what you want.

vibragiel 16y ago

This quote is my favourite part of the conference: "The purpose of cryptography is to force the US government to torture you."

cperciva 16y ago
That's my favourite line too -- I'm glad I'm not the only person who liked it. :-)

calloc 16y ago

The video is not playing here. Was it removed? Nevermind, noticed that it is going to Blip.tv, here it is on Blip.tv if the linked site doesn't work: http://blip.tv/file/3627639/ http://blip.tv/file/3627639/